以太坊基金会向WEBCAT提供安全资助，助力钱包验证前端代码防范钓鱼攻击

Odaily Planet Daily News: The Ethereum Foundation's "Trillion Dollar Security" (1TS) initiative has announced a dedicated grant to the Freedom of the Press Foundation (FPF) to support the continued development of the open-source tool WEBCAT, addressing the long-standing security gap in front-end code verification for Ethereum wallets and decentralized applications (DApps).

WEBCAT (Web-based Code Assurance and Transparency) is an open-source tool designed to help browsers verify that the code loaded by a website matches the version publicly released by its developers. This grant will drive the expansion of WEBCAT to Ethereum wallets and application scenarios, enabling users to verify whether the front-end pages they access have been tampered with.

The Ethereum Foundation stated that while HTTPS currently verifies the website a user connects to and encrypts communication, it cannot prove that the front-end code actually running on the website is the version released by developers. If an attacker gains control over a website's front-end code, they could modify transaction recipient addresses without the user's knowledge, or trick users into signing transactions that differ from what is displayed on the page.

The Ethereum Foundation noted that front-end attacks have become a significant security risk in blockchain infrastructure. Malicious modifications to web interfaces could lead to supply chain attacks, post-DNS-hijacking attacks, and user interface spoofing.

WEBCAT was originally developed by the Freedom of the Press Foundation to enhance code trustworthiness in secure communication systems like SecureDrop. With this expansion into the Ethereum ecosystem, it will complement security measures under the 1TS initiative, such as "Clear Signing": the former helps wallets confirm that the application front-end has not been tampered with, while the latter helps users understand the transaction content they are approving.